Which approach will resolve the encryption requirement?
Log in to the RDS console and select the encryption box to encrypt the database.
Create a new encrypted Amazon EBS volume and attach it to the instance.
Encrypt the standby replica in the secondary Availability Zone and promote it to the primary instance.
Take a snapshot of the RDS instance, copy and encrypt the snapshot, and then restore to the new RDS instance.
Explanations:
You cannot modify the encryption of an existing RDS instance directly. Encryption must be enabled during instance creation.
You cannot attach a new encrypted Amazon EBS volume to an existing RDS instance to enable encryption. The encryption must be set during the instance creation or via a snapshot process.
Encrypting a standby replica does not affect the encryption of the primary instance. You must use a snapshot to enable encryption on the primary instance.
The correct method involves taking a snapshot of the existing RDS instance, copying it with encryption enabled, and restoring it to a new encrypted instance. This process enables encryption for the database.
As far as I can tell, the answer is:
Take a snapshot of the RDS instance, copy and encrypt the snapshot, and then restore to the new RDS instance.